------------[ cut here ]------------
workqueue: cannot queue hci_conn_timeout on wq hci4
WARNING: CPU: 1 PID: 5988 at kernel/workqueue.c:2258 __queue_work+0xd62/0xfe0 kernel/workqueue.c:2256
Modules linked in:
CPU: 1 UID: 0 PID: 5988 Comm: syz.4.5 Not tainted 6.16.0-rc2-syzkaller-g190113989ae0 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__queue_work+0xd62/0xfe0 kernel/workqueue.c:2256
Code: 42 80 3c 20 00 74 08 4c 89 ef e8 89 08 99 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 40 e0 89 8b 4c 89 fa e8 1f 34 f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 50 89 35 00 90 0f 0b 90 e9 dd fc ff
RSP: 0018:ffffc90000a08b08 EFLAGS: 00010046
RAX: 74052fb74c5e4200 RBX: 0000000000000100 RCX: ffff888030828000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 1ffff1100365f738 R08: ffff8880b8724293 R09: 1ffff110170e4852
R10: dffffc0000000000 R11: ffffed10170e4853 R12: dffffc0000000000
R13: ffff888030890960 R14: 0000000000000008 R15: ffff88801b2fb978
FS: 0000000000000000(0000) GS:ffff888125d51000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6fb6db5f40 CR3: 000000002891a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1793 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x646/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__schedule+0x16fd/0x4d00 kernel/sched/core.c:6745
Code: f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 69 b0 bc f6 4d 89 27 4c 89 f7 4c 89 e6 e8 db 12 cc f5 48 89 c7 e8 e3 bd 2a f6 <31> ff 4d 39 e6 40 0f 95 c7 48 8b b4 24 c0 00 00 00 e8 2d c7 2a f6
RSP: 0018:ffffc9000b57ed20 EFLAGS: 00000286
RAX: 74052fb74c5e4200 RBX: ffff888030828780 RCX: 74052fb74c5e4200
RDX: 0000000000000007 RSI: ffffffff8d9820ce RDI: ffffffff8be28b80
RBP: ffffc9000b57ef30 R08: ffffffff8fa10df7 R09: 1ffffffff1f421be
R10: dffffc0000000000 R11: fffffbfff1f421bf R12: ffff888030828000
R13: dffffc0000000000 R14: ffff888030828000 R15: ffff8880b873b900
preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7108
irqentry_exit+0x6f/0x90 kernel/entry/common.c:307
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:free_pages_and_swap_cache+0x100/0x520 mm/swap_state.c:255
Code: 48 89 5c 24 20 0f 8e ac 03 00 00 48 8d 44 24 60 48 83 c0 08 48 89 44 24 38 49 63 cf 48 8b 44 24 28 48 89 4c 24 30 48 8d 1c c8 <49> 89 dc 49 c1 ec 03 43 80 3c 2c 00 74 08 48 89 df e8 ba c4 08 00
RSP: 0018:ffffc9000b57f0a0 EFLAGS: 00000293
RAX: ffff888072ab0010 RBX: ffff888072ab0a80 RCX: 000000000000014e
RDX: 0000000000000000 RSI: 0000000000000018 RDI: 000000000000001f
RBP: ffffc9000b57f328 R08: ffffea00016fb187 R09: 1ffffd40002df630
R10: dffffc0000000000 R11: fffff940002df631 R12: 1ffff1100e55614f
R13: dffffc0000000000 R14: 0000000000000018 R15: 000000000000014e
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu+0x3a0/0x680 mm/mmu_gather.c:404
zap_pte_range mm/memory.c:1774 [inline]
zap_pmd_range mm/memory.c:1827 [inline]
zap_pud_range mm/memory.c:1856 [inline]
zap_p4d_range mm/memory.c:1877 [inline]
unmap_page_range+0x38fd/0x41c0 mm/memory.c:1898
unmap_single_vma mm/memory.c:1941 [inline]
unmap_vmas+0x399/0x580 mm/memory.c:1985
exit_mmap+0x248/0xb50 mm/mmap.c:1284
__mmput+0x118/0x420 kernel/fork.c:1121
exit_mm+0x1da/0x2c0 kernel/exit.c:581
do_exit+0x640/0x22e0 kernel/exit.c:943
do_group_exit+0x21c/0x2d0 kernel/exit.c:1104
get_signal+0x1286/0x1340 kernel/signal.c:3034
arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0b6db8e929
Code: Unable to access opcode bytes at 0x7f0b6db8e8ff.
RSP: 002b:00007f0b6e962038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: 0000000000000000 RBX: 00007f0b6ddb5fa0 RCX: 00007f0b6db8e929
RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003
RBP: 00007f0b6dc10b39 R08: 0000000000000043 R09: 0000000000000000
R10: 00002000000008c0 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f0b6ddb5fa0 R15: 00007ffc76f1c928
----------------
Code disassembly (best guess):
0: f8 clc
1: 48 c1 e8 03 shr $0x3,%rax
5: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
a: 74 08 je 0x14
c: 4c 89 ff mov %r15,%rdi
f: e8 69 b0 bc f6 call 0xf6bcb07d
14: 4d 89 27 mov %r12,(%r15)
17: 4c 89 f7 mov %r14,%rdi
1a: 4c 89 e6 mov %r12,%rsi
1d: e8 db 12 cc f5 call 0xf5cc12fd
22: 48 89 c7 mov %rax,%rdi
25: e8 e3 bd 2a f6 call 0xf62abe0d
* 2a: 31 ff xor %edi,%edi <-- trapping instruction
2c: 4d 39 e6 cmp %r12,%r14
2f: 40 0f 95 c7 setne %dil
33: 48 8b b4 24 c0 00 00 mov 0xc0(%rsp),%rsi
3a: 00
3b: e8 2d c7 2a f6 call 0xf62ac76d